On upgrade you put the PP5022.mi4 on the file system root, but when
the device upgrades to this it moves it elsewhere and removes it from the
root filesystem. On other mi4 devices, such as the iriver H10, you put the
mi4 file in the /system/ directory and the bootloader loads it
directly from there...

It seems the Sansa moves the firmware image to a difference place, which
is accessible through the second partition of the device. In that partition,
at offset 0x80200, the mi4 file seems to be located.

With a more recent Sansa firmware SanDisk changed the TEA encryption key
(and named their firmware file "firmware.mi4"). mi4code is updated to
decrypt both versions fine.

Sansa Rhapsody

The Rhapsody version of the Sansa e200 series uses yet another key that
was successfully extracted on February 23, 2007. Use mi4code 0.9.33 or
later. They name the firmware file pp5022.mi4 (note the lower case).

The Rhapsody BL does not allow a "dummy" DSA signed mi4 file to get
loaded. This means we must either patch the existing BL to allow the loading
of the Rockbox bootloader, or we must "upgrade" the R model BL to a vanilla
Sansa model BL.

Some initial tests of patching the original R BL file (with a .btl
extension) seems to indicate that installing a patch BL file on the R model is
somehow prohibited...

Sansa USB Modes

The Sansas seem to have at least four (4) different USB modes in which it can
start and allow various kinds of accesses from a host computer:

"pre-bootloader" - in which the Sansa appears as a "PortalPlayer USB
Device." - e200tool 0.0.6 and later can (hopefully) access the device in this
mode. A device might stop here due to a corrupted i2c rom.

"Manufacturing" - see below, access it with e200tool. A device might
require this mode due to a corrupted bootloader.

"Recovery" - normal UMS mode but with a 16MB disk in which you can
restore/upgrade mi4 and bootloader images.

"Firmware" - when the normal firmware runs you get to a normal UMS mode
that exposes the whole data partition of the NAND flash.

FM Tuner in Euro version

It has been confirmed by SanDisk that the disabling of the FM tuner in the
euro version of the player is done in firmware/software.

This is contradicted by the people that claim that the euro version has no
radio chip insde... Different HW revisions doing it differently perhaps?

Recovery Mode

If you put a bad mi4 on the device it can no longer function properly, but you
must then enter Recovery Mode and correct the bad image.